PT-2012-3191 · Cisco · Cisco Unified Ip Phones 9900

Published 2012-05-03 · Updated 2017-12-07 · CVE-2012-1328

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Cisco Unified IP Phones 9900 series devices with firmware 9.1 and 9.2

Description The issue is related to the improper handling of configuration information downloads to an RT phone, allowing local users to gain privileges via injected data.

Recommendations For firmware 9.1, update to a version that properly handles configuration information downloads. For firmware 9.2, update to a version that properly handles configuration information downloads. As a temporary workaround, consider restricting access to the configuration download feature until a patch is available.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2012-1328

Affected Products

Cisco Unified Ip Phones 9900

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2012-1328 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1328 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/75412 · Note
• http://cisco.com/en/US/docs/voice_ip_comm/cuipph/9971_9951_8961/firmware/9_2_3/release_notes/9900_8900_923.html · Note